Forwarded information determination method and device, gateway and storage medium

Abstract

The embodiment of the invention provides a forwarding information determination method and device, a gateway and a computer readable storage medium, and relates to the technical field of cloud computing. The method comprises the steps that a first multi-element group is extracted from a data packet header of a first data packet, then a first session table is obtained, a first hash value corresponding to K-item information in the first multi-element group is determined, and the first session table comprises at least one first key value pair; matching the first hash value and the L-K item information in the first multi-element group with a first key value pair of a first session table; and if the first data packet is successfully matched with one of the first key value pairs, determining target forwarding information of the first data packet based on first forwarding indication information corresponding to the value of the successfully matched first key value pair. According to the embodiment of the invention, the on-chip storage space occupied by the first session table can be reduced, and the supported state session scale is improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology. Specifically, the present application relates to a method, device, gateway and storage medium for determining forwarding information. Background Art

[0002] In cloud computing networks, stateful gateways can be found everywhere, such as NAT (Network Address Translation) gateways, ACL (Access Control Lists) gateways, or load balancing gateways. The characteristics of these gateways are that they match the received data packet header field information according to the rules. If the match is hit, a corresponding session will be generated and the session will be continuously processed. Compared with other data packets without rules, data packets with sessions will receive faster service processing. At present, stateful gateways need to use chips, such as switch chips, to forward data packets based on session tables.

[0003] In the related art, the quintuple information and its corresponding forwarding information are directly stored as table elements in the session table. If the field in the data packet header of the data packet hits the quintuple information of the session table, the forwarding information corresponding to the hit quintuple information is determined as the forwarding information of the data packet.

[0004] However, the memory on the switch chip is limited. Directly storing the quintuple information and the corresponding mapped forwarding information as table elements in the state table occupies a large amount of on-chip storage space of the switch chip, making the scale of state sessions that the switch chip can support very limited. Summary of the invention

[0005] The embodiments of the present application provide a method, device, gateway and storage medium for determining forwarding information, which are used to solve the technical problem that the scale of state sessions that a switch chip can support is very limited.

[0006] On the one hand, an embodiment of the present application provides a method for determining forwarding information, including:

[0007] Obtaining a first data packet to be forwarded;

[0008] extracting a first tuple from a data packet header of a first data packet;

[0009] Obtain a preset first session table entry, and determine a first hash value corresponding to K items of information in the first tuple, 1≤K<L, L represents the total number of information items in the tuple, the first session table entry includes a first session table, the first session table includes at least one first key-value pair, for each first key-value pair, the key of the first key-value pair corresponds to the second hash value and LK items of information in the second tuple of the forwarded second data packet, the second hash value is a hash value corresponding to the K items of information in the second tuple, the value of the first key-value pair corresponds to first forwarding indication information, and the first forwarding indication information is used to determine forwarding information corresponding to the second tuple;

[0010] Matching the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table;

[0011] If the match with one of the first key-value pairs is successful, the target forwarding information of the first data packet is determined based on the first forwarding indication information corresponding to the value of the first key-value pair that is successfully matched.

[0012] On the other hand, the embodiment of the present application also provides a method for determining forwarding information, including:

[0013] Acquire a first data packet from a second chip;

[0014] extracting a first tuple from a data packet header of a first data packet;

[0015] Searching for a target session table entry corresponding to the first multi-tuple from a preset second session table entry, the target session table entry includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and LK items of information in the first multi-tuple, the first hash value is a hash value corresponding to K items of information in the first multi-tuple, the value of the fourth key-value pair corresponds to second forwarding indication information, and the second forwarding indication information is used to determine target forwarding information corresponding to the first multi-tuple, wherein 1≤K<L, and L represents the total number of information items in the multi-tuple;

[0016] If the target session table entry is successfully searched, the target forwarding information of the first data packet is determined based on the target session table entry, and the target session table entry is sent to the second chip, so that the second chip updates the preset first session table entry based on the target session table entry, wherein the fourth session table is used to update the first session table in the first session table entry.

[0017] On the other hand, an embodiment of the present application further provides a device for determining forwarding information, including:

[0018] A first acquisition module, used to acquire a first data packet to be forwarded;

[0019] A first extraction module, configured to extract a first tuple from a data packet header of a first data packet;

[0020] a second acquisition module, configured to acquire a preset first session table entry, and determine a first hash value corresponding to K items of information in the first tuple, 1≤K<L, L represents the total number of information items in the tuple, the first session table entry includes a first session table, the first session table includes at least one first key-value pair, for each first key-value pair, a key of the first key-value pair corresponds to a second hash value and LK items of information in a second tuple of a forwarded second data packet, the second hash value is a hash value corresponding to the K items of information in the second tuple, a value of the first key-value pair corresponds to first forwarding indication information, and the first forwarding indication information is used to determine forwarding information corresponding to the second tuple;

[0021] A first determination module, configured to match the first hash value and the LK item information in the first tuple with a first key-value pair of the first session table;

[0022] The first determination module is further configured to determine target forwarding information of the first data packet based on first forwarding indication information corresponding to the value of the successfully matched first key-value pair if the match with one of the first key-value pairs is successful.

[0023] Optionally, the first session table item further includes at least one second session table, each second session table includes at least one second key-value pair, for each second key-value pair of a second session table, the key of the second key-value pair corresponds to at least part of the K items of information in the second tuple, the value of the second key-value pair corresponds to the first code value, and the set of information of at least one second session table includes the K items of information in the second tuple; when determining the first hash value corresponding to the K items of information in the first tuple, the second acquisition module is used to: match the K items of information in the first tuple with the second key-value pairs in each second session table to determine a target code value group corresponding to the K items of information in the first tuple; and determine the first hash value corresponding to the K items of information in the first tuple based on the target code value group.

[0024] Optionally, at least one second session table includes a first session sub-table and a second session sub-table, the key of the second key-value pair of the first session sub-table corresponds to M items of information in the K items of information in the second tuple, the key of each second key-value pair of the second session sub-table corresponds to KM items of information in the K items of information in the second tuple, 1≤M<K; when the second acquisition module matches the K items of information in the first tuple with the second key-value pairs in each second session table to determine the target code value group corresponding to the K items of information in the first tuple, it is used to: match the M items of information in the first tuple with the second key-value pairs of the first session sub-table Matching is performed, and the KM item information in the first tuple is matched with the second key-value pair of the second session subtable; if the match with one of the second key-value pairs of the first session subtable and one of the second key-value pairs of the second session subtable is successful, a first target coding value and a second target coding value are obtained, the first target coding value is a coding value corresponding to the value of the successfully matched second key-value pair of the first session subtable, and the second target coding value is a coding value corresponding to the value of the successfully matched second key-value pair of the second session subtable; the first target coding value and the second target coding value are used as at least part of the target coding value group.

[0025] Optionally, the second acquisition module is also used for at least one of the following: if the match with any second key-value pair of the first session sub-table fails, the preset invalid coding value is used as the first target coding value or the first data packet is sent to the first chip; if the match with any second key-value pair of the second session sub-table fails, the preset invalid coding value is used as the second target coding value or the first data packet is sent to the first chip.

[0026] Optionally, there are at least two first session tables, and the at least two first session tables correspond one-to-one to at least two hash functions. For each of the at least two first session tables, the second hash value corresponding to the key of the first key-value pair of the first session table is determined based on the hash function corresponding to the first session table; when the second acquisition module determines the first hash value corresponding to the K items of information in the first tuple based on the target code value group, it is used to: compress the target code value group based on each hash function of the at least two hash functions to obtain the first hash value corresponding to each hash function; when the first determination module matches the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table, it is used to: respectively match the first hash value corresponding to each hash function and the LK item information of the first tuple information with the first key-value pair of the first session table corresponding to each hash function.

[0027] Optionally, the first determination module is also used to determine the LK item information in the first session table in the following manner: obtain multiple forwarded second data packets; for each second data packet, extract a second tuple from the data packet header of the second data packet, the second tuple including the source protocol address, the source port, the protocol, the destination protocol address and the destination port; based on the second tuple corresponding to each second data packet, determine the first maximum number of occurrences of the same source address, the second maximum number of occurrences of the same source port, the third maximum number of occurrences of the same protocol, the fourth maximum number of occurrences of the same destination protocol address and the fifth maximum number of occurrences of the same destination port in the multiple second data packets; determine the maximum value among the first maximum number of occurrences, the second maximum number of occurrences, the third maximum number of occurrences, the fourth maximum number of occurrences and the fifth maximum number of occurrences; and determine an item of information corresponding to the maximum value in the second tuple as the LK item information in the first session table.

[0028] Optionally, the forwarding information includes first forwarding information and second forwarding information, the first forwarding indication information includes a second encoding value and the second forwarding information, the first session table item also includes a third session table, the third session table includes at least one third key-value pair, for each third key-value pair, the key of the third key-value pair corresponds to the third encoding value, and the value of the third key-value pair corresponds to the first forwarding information; when the first determination module determines the target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the first key-value pair that matches successfully, the first determination module is used to: match the first encoding value corresponding to the value of the first key-value pair that matches successfully with the third key-value pair of the third session table; if the match is successful with one of the third key-value pairs, the first forwarding information corresponding to the value of the third key-value pair that matches successfully and the second forwarding information corresponding to the value of the first key-value pair that matches successfully are determined as at least part of the target forwarding information of the first data packet; the first determination module is also used to discard the first data packet if the match with any third key-value pair fails.

[0029] Optionally, the second acquisition module is also used to: if the match with any first key-value pair fails, send the first data packet to the first chip, so that the first chip determines the target forwarding information of the first data packet; obtain the target session table item from the second chip; update the first session table item based on the target session table item, so that when a new data packet to be forwarded is obtained, the forwarding information of the new data packet to be forwarded is determined based on the updated first session table item; wherein the target session table item includes the target session table item including a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and the LK item information in the first tuple, the first hash value is the hash value corresponding to the K item information of the first tuple, the value of the fourth key-value pair corresponds to the second forwarding indication information, the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, and the fourth session table is used to update the first session table in the first session table item.

[0030] On the other hand, an embodiment of the present application further provides a device for determining forwarding information, including:

[0031] A third acquisition module, used to acquire a first data packet from a second chip;

[0032] A second extraction module, configured to extract a first tuple from a data packet header of the first data packet;

[0033] A search module is used to search for a target session table item corresponding to the first multi-group from a preset second session table item, the target session table item includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and LK items of information in the first multi-group, the first hash value is a hash value corresponding to K items of information in the first multi-group, the value of the fourth key-value pair corresponds to second forwarding indication information, and the second forwarding indication information is used to determine the target forwarding information corresponding to the first multi-group, wherein 1≤K<L, and L represents the total number of information items in the multi-group;

[0034] The second determination module is used to determine the target forwarding information of the first data packet based on the target session table item if the target session table item is successfully searched, and send the target session table item to the second chip, so that the second chip updates the preset first session table item based on the target session table item, wherein the fourth session table is used to update the first session table in the first session table item.

[0035] Optionally, the target session table entry further includes at least one item of at least one fifth session table or a sixth session table, wherein the fifth session table is used to update the second session table in the first session table entry, and the sixth session table is used to update the third session table in the first session table entry; each fifth session table includes a fifth key-value pair, and for a fifth key-value pair of a fifth session table, a key of the fifth key-value pair corresponds to at least part of K items of information in the first tuple, and a value of the fifth key-value pair corresponds to a target encoding value, and a set of information of at least one fifth session table includes the K items of information in the first tuple; the target forwarding information includes first target forwarding information and second target forwarding information, the second forwarding indication information includes a fourth encoding value and a second target forwarding information, and the sixth session table includes a sixth key-value pair, a key of the sixth key-value pair corresponds to the fourth encoding value, and a value of the sixth key-value pair corresponds to the first target forwarding information.

[0036] Optionally, the fifth session table includes a third session sub-table and a fourth session sub-table, the key in the fifth key-value pair of the third session sub-table corresponds to M items of information in the K items of information in the first tuple, the value in the fifth key-value pair of the third session sub-table corresponds to the first target coding value, the key in the fifth key-value pair of the fourth session sub-table corresponds to the KM items of information in the first tuple, the value in the fifth key-value pair of the fourth session sub-table corresponds to the second target coding value, 1≤M<K; wherein, the third session sub-table is used to update the first session sub-table in the second session table, and the fourth session sub-table is used to update the second session sub-table in the second session table.

[0037] Optionally, if the query of the target session table item fails, the second determination module is further used to allocate a target code value group corresponding to the K items of information in the first multi-group; obtain a hash collision result, the hash collision result characterizing the candidate code value group corresponding to each hash function of at least two hash functions, wherein, for each hash function, any two candidate code value groups corresponding to the hash function are different based on the hash values ​​determined by the hash function; if the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, allocate the target forwarding information of the first data packet, generate a target session table item based on the target forwarding information, and send the target session table item to the second chip; wherein the first hash value corresponding to the key in the fourth key-value pair of the fourth session table is obtained by compressing the target code value group based on the hash function corresponding to the candidate code value group that is the same as the target code value group.

[0038] Optionally, the hash conflict result is obtained by the second determination module in the following manner: obtaining multiple candidate coding value groups; performing hash conflict resolution processing on the multiple candidate coding value groups through at least two hash functions until the end condition is met to obtain a hash conflict result; wherein the hash conflict resolution processing includes: compressing each candidate coding value group in the multiple candidate coding value groups through one of the hash functions to obtain a hash value corresponding to each candidate coding value group; if the hash value corresponding to one of the candidate coding value groups is different from the hash value corresponding to any other candidate coding group in the multiple candidate coding value groups, then one of the candidate coding value groups is used as the candidate coding value group corresponding to one of the hash functions, and the other candidate coding groups are candidate coding value groups other than one of the candidate coding value groups; if the hash values ​​corresponding to at least two groups of candidate coding value groups are the same, then compressing at least two groups of candidate coding value groups with the same hash value through another hash function; wherein the end condition includes at least one of the following: one of the at least two hash functions corresponding to each candidate coding group in the multiple candidate coding value groups; hash conflict resolution processing has been performed through any of the at least two hash functions.

[0039] On the other hand, an embodiment of the present application further provides a gateway, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method of any embodiment of the present application.

[0040] On the other hand, an embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the method of any embodiment of the present application is implemented.

[0041] On the other hand, an embodiment of the present application further provides a computer program product, including a computer program, which implements the method of any embodiment of the present application when the computer program is executed by a processor.

[0042] The technical solution of this embodiment is as follows: extracting a first tuple from a data packet header of a first data packet, obtaining a first session table and determining a first hash value corresponding to K items of information in the first tuple, the first session table including at least one first key-value pair, for each first key-value pair, the key of the first key-value pair corresponds to a second hash value and LK items of information in a second tuple of a forwarded second data packet, the value of the first key-value pair corresponds to first forwarding indication information, the first forwarding indication information is used to determine forwarding information corresponding to the second tuple, matching the first hash value and the LK items of information in the first tuple with the first key-value pair of the first session table; if the match with one of the first key-value pairs is successful, determining the target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the successfully matched first key-value pair, because the first session table stores the second hash value and LK items of information, and the bytes of the hash value are smaller than the bytes of the K items of information, thereby being able to reduce the on-chip storage space occupied by the first session table, and to increase the scale of state sessions supported. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0044] Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application;

[0045] Figure 2 A flowchart of a method for determining forwarding information provided in an embodiment of the present application;

[0046] Figure 3 A schematic diagram of a process for matching a first session entry provided in an embodiment of the present application;

[0047] Figure 4 A flowchart of another method for determining forwarding information provided in an embodiment of the present application;

[0048] Figure 5 A schematic diagram of a process for generating a target session table entry provided in an embodiment of the present application;

[0049] Figure 6-Figure 8 A schematic diagram of a process for resolving hash conflicts provided in an embodiment of the present application;

[0050] Fig. 9 A flowchart of another method for determining forwarding information provided in an embodiment of the present application;

[0051] Fig.10 A schematic diagram of the structure of a device for determining forwarding information provided in an embodiment of the present application;

[0052] Fig.11 A schematic diagram of the structure of another device for determining forwarding information provided in an embodiment of the present application;

[0053] Fig.12 A schematic diagram of the structure of a gateway provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0055] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "an", and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the technical field. It should be understood that when we call an element "connected" or "coupled" to another element, the one element may be directly connected or coupled to the other element, or it may refer to that the one element and the other element establish a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used here may include wireless connection or wireless coupling. The term "and / or" used here indicates at least one of the items defined by the term, such as "A and / or B" indicates implementation as "A", or implementation as "A", or implementation as "A and B". "Multiple" refers to two or more.

[0056] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0057] First, several terms involved in this application are introduced and explained:

[0058] NAT Gateway: Network Address Translation Gateway. Usually provides address translation services for servers that need to access the public network;

[0059] ACL Gateway: Access Control List Gateway. Usually a packet filtering service set up for security.

[0060] Load balancing gateway: For scenarios with large traffic, it provides services to divert incoming traffic.

[0061] ASIC chip: Application Specific Integrated Circuit. A dedicated integrated chip, specifically referring to the chip of a programmable switch in the present invention.

[0062] See also Figure 1 , Figure 1 A schematic diagram of an implementation environment provided for an embodiment of the present application.

[0063] Figure 1 A schematic diagram of an implementation environment provided by an exemplary embodiment of the present application is shown. The implementation environment includes a first edge node 110 and a second edge node 120, and the first edge node 110 is provided with a first business server 111 and a first gateway 112. The second edge node 120 is provided with a second business server 121 and a second gateway 122. Among them, the devices in the edge nodes communicate data through a communication network. Optionally, the communication network can be a wired network or a wireless network, and the communication network can be at least one of a local area network, a metropolitan area network, and a wide area network. The first gateway and the second gateway are respectively provided with a first chip and a second chip. The first chip can be a CPU (central processing unit) chip. The CPU chip is used to perform various data processing. The second chip can be a switch chip, which mainly processes data forwarding, etc. Generally speaking, the memory of the CPU chip is larger than the memory of the switch chip. Optionally, the switch chip can be an ASIC chip.

[0064] The edge nodes communicate data through the switch chip, and the switch chips can communicate data through the public network, and the devices inside the edge node can communicate data through the intranet. The first edge node 110 and the second edge node 120 can be edge computing sites set in different geographical locations, and the edge nodes provide services for devices in the nearby area. For example, the first edge node 110 is an edge computing site set in Shanghai, and the second edge node 120 is an edge computing site set in Beijing. The first edge node 110 provides services for devices in the East China region, and the second edge node 120 provides services for devices in the North China region. The first business server 111 and the second business server 121 are used to provide corresponding services for the accessed devices. For example, the services provided by the business server may include live video, online education, etc., and the embodiments of the present application do not limit the services provided by the business server. In some scenarios, the business data between different edge nodes needs to interact to ensure the consistency of the business data between different edge nodes. For example, in the live video scenario, the video interaction data (such as barrage data) received by the business servers in different edge nodes needs to interact to ensure the consistency of the video interaction data seen by live viewers in different regions. In some embodiments, the gateway is used to process the business data based on business needs. For example, network address translation is implemented. Of course, in addition to the above functions, the gateway can also implement other functions according to business requirements, which is not limited in this embodiment.

[0065] In the related art, the quintuple information and its corresponding forwarding information are directly stored as table elements in the session table. If the field in the data packet header of the data packet hits the quintuple information of the session table, the forwarding information corresponding to the hit quintuple information is determined as the forwarding information of the data packet.

[0066] However, the memory on the switch chip is limited. Directly storing the quintuple information and the corresponding mapped forwarding information as table elements in the state table occupies a large amount of on-chip storage space of the switch chip, making the scale of state sessions that the switch chip can support very limited.

[0067] Therefore, the following embodiments are described by how to solve the technical problem that the scale of state sessions that a switch chip can support is very limited.

[0068] Optionally, the present application may relate to the field of cloud computing technology, such as forwarding data packets to a cloud server and using the cloud server to process the data packets.

[0069] Among them, cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model. It can form a resource pool, which is used on demand and is flexible and convenient. Cloud computing technology will become an important support. Cloud storage is a new concept extended and developed from the concept of cloud computing. Distributed cloud storage system (hereinafter referred to as storage system) refers to a storage system that uses cluster applications, grid technology, and distributed storage file systems to bring together a large number of different types of storage devices (storage devices are also called storage nodes) in the network through application software or application interfaces to work together and provide data storage and target business access functions to the outside world.

[0070] See also Figure 2 , Figure 2 A flow chart of a method for determining forwarding information provided in an embodiment of the present application. Figure 2 The method shown can be executed by the second chip. Figure 2 The methods shown may include:

[0071] S210: Obtain a first data packet to be forwarded.

[0072] S220: Extract a first tuple from a data packet header of a first data packet.

[0073] Among them, generally speaking, the data packet header of the first data packet stores five-tuple information, and the five-tuple information usually includes a set of five quantities: source IP (Internet Protocol) address, source port, destination IP address, destination port and transport layer protocol. For example, 192.168.1.1 10000 TCP (Transmission Control Protocol) 121.14.88.76 80 constitutes a five-tuple. Its meaning is that a terminal with an IP address of 192.168.1.1 is connected to a terminal with an IP address of 121.14.88.76 and a port of 80 through port 10000 using the TCP protocol. The five-tuple can distinguish different sessions, and the corresponding sessions are unique.

[0074] In this embodiment, the first tuple may include at least part of the information in the five-tuple information, that is, include part or all of the five-tuple information. For example, the first tuple includes the source IP address, source port, destination IP address, destination port and transport layer protocol.

[0075] S230: Obtain a preset first session table entry, and determine a first hash value corresponding to K items of information in a first tuple, wherein the first session table entry includes a first session table, and the first session table includes at least one first key-value pair.

[0076] The first session table item may refer to a session table item preset by the second chip. The first session table item includes at least one session table. In this embodiment, the first session table item may include a first session table. The value range of K may be: 1≤K<L, where L represents the total number of information items in the tuple. Optionally, L may be an integer not less than 2 and not greater than 5. Taking the first tuple including the source IP address, source port, destination IP address, destination port, and transport layer protocol as an example, the K items of information in the first tuple may include the source IP address, the destination IP address, the destination port, and the transport layer protocol.

[0077] Among them, for each first key-value pair, the key of the first key-value pair corresponds to the second hash value and the LK item information in the second tuple of the forwarded second data packet, and the value of the first key-value pair corresponds to the first forwarding indication information, and the first forwarding indication information is used to determine the forwarding information corresponding to the second tuple.

[0078] Among them, the forwarding information may refer to the next address information to be forwarded to. Optionally, the forwarding information may include first forwarding information and second forwarding information. The first forwarding information may be the next IP address, and the second forwarding information may refer to the next port. Taking the NAT gateway as an example, if it is from the public network to the intranet, the next IP address may be the intranet IP address, and the next port may be the intranet port; if it is from the intranet to the public network, the next IP address may be the public IP address, and the next port may be the public port. The first forwarding indication information may include first forwarding indication sub-information and second forwarding indication sub-information. Specifically, the first forwarding indication sub-information may be a unique ID (code, Identity document) value for determining the first forwarding information or the first forwarding information itself. Similarly, the second forwarding indication sub-information may be a code value for determining the second forwarding information or the second forwarding message itself.

[0079] Please refer to Table 1 to Table 3 respectively. Table 1 to Table 3 are schematic diagrams of a first session table provided in an embodiment of the present application.

[0080] As shown in Table 1, the key of the first key-value pair of the first session table corresponds to the second hash value and the LK item information, and the value of the first key-value pair of the first session table corresponds to the first forwarding information and the second forwarding information.

[0081] Table 1

[0082]

[0083] Among them, hash(outside id, insideid) represents the hash value, inside port represents the port of the intranet, nat port represents the port of the public network, Nat ip represents the IP address of the public network, Nat port represents the port of the public network, insideip represents the IP address of the intranet, and inside port represents the port of the intranet.

[0084] As shown in Table 2, the key of the first key-value pair of the first session table corresponds to the second hash value and the LK item information, and the value of the first key-value pair of the first session table corresponds to the ID value corresponding to the first forwarding information and the second forwarding information.

[0085] Table 2

[0086]

[0087] Among them, "Nat id" represents the coding value corresponding to Nat ip, and "Inside id" represents the coding value corresponding to Inside ip.

[0088] As shown in Table 3, the key of the first key-value pair of the first session table corresponds to the second hash value and the LK item information, and the value of the first key-value pair of the first session table corresponds to the ID value corresponding to the first forwarding information and the second forwarding information.

[0089] Table 3

[0090]

[0091] Among them, "Nat id" indicates the coding value corresponding to the Nat port, and "Inside id" indicates the coding value corresponding to the Inside port.

[0092] In this embodiment, the first forwarding information may be one of the next address and the next port, and the second forwarding information may be the other of the next address and the next port.

[0093] The second hash value is a hash value corresponding to the K items of information in the second tuple. It can be understood that the method for determining the first hash value corresponding to the K items of information in the first tuple is the same as the method for determining the second hash value corresponding to the K items of information in the second tuple. In this embodiment, the byte corresponding to the hash value corresponding to the K items of information is smaller than the byte corresponding to the K items of information.

[0094] It should be noted that although the first multi-tuple and the second multi-tuple both include K items of information, the specific content of any of the K items of information in the first multi-tuple and the second multi-tuple may be the same or different, depending on the actual situation, and is not limited here.

[0095] Exemplarily, assuming that the first tuple includes 192.168.1.1 10000 TCP 121.14.88.76 80, the second tuple may include 192.168.1.1 10000 TCP 121.14.88.76 80, and may also include 192.168.1.1 10000 TCP 121.14.88.76 81.

[0096] S240: Match the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table.

[0097] Among them, LK item information refers to other information in the L item information of the tuple except K item information. Taking the first tuple including source IP address, source port, destination IP address, destination port and transport layer protocol as an example, the K item information of the first tuple may include source IP address, destination IP address, destination port and transport layer protocol. LK item information may include source port.

[0098] In this embodiment, the first hash value and the LK item information in the first tuple are matched with the first key-value pair, which can be to match the first hash value and the LK item information in the first tuple with the key in the first key-value pair. If the first hash value is consistent with the second hash value in the first key-value pair, and the specific content of the LK item information in the first tuple is consistent with the specific content of the LK item information in the first tuple in the first key-value pair, the match is successful. If at least one of the first hash value and the second hash value in the first key-value pair are inconsistent, or the specific content of the LK item information in the first tuple is inconsistent with the specific content of the LK item information in the first tuple in the first key-value pair, the match fails.

[0099] S250: If a match is successful with one of the first key-value pairs, determine the target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the first key-value pair that is successfully matched.

[0100] The technical solution of this embodiment is as follows: extracting a first tuple from a data packet header of a first data packet, obtaining a first session table and determining a first hash value corresponding to K items of information in the first tuple, the first session table including at least one first key-value pair, for each first key-value pair, the key of the first key-value pair corresponds to a second hash value and LK items of information in a second tuple of a forwarded second data packet, the value of the first key-value pair corresponds to first forwarding indication information, the first forwarding indication information is used to determine forwarding information corresponding to the second tuple, matching the first hash value and the LK items of information in the first tuple with the first key-value pair of the first session table; if the match with one of the first key-value pairs is successful, determining the target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the successfully matched first key-value pair, because the first session table stores the second hash value and LK items of information, and the bytes of the hash value are smaller than the bytes of the K items of information, thereby being able to reduce the on-chip storage space occupied by the first session table, and to increase the scale of state sessions supported. In addition, a tuple with the same K items of information can share a pair of first key-value pairs, thereby reducing the number of first key-value pairs and further reducing the on-chip storage space occupied by the first session table. Then, the second chip can store more first key-value pairs in the first session table, which can further increase the scale of supported state sessions. In addition, since the first hash value corresponding to K items of information is determined, that is, the first hash value corresponding to part of the information in the tuple is determined, compared with determining the hash value corresponding to all the information in the tuple, the present application determines the first hash value corresponding to K items of information and can also reduce the computing resources required to calculate the hash value.

[0101] It should be noted that the method for determining the hash value corresponding to the K items of information may be to directly calculate the corresponding hash value based on the K items of information. For example, the K items of information are compressed based on a hash function to obtain the corresponding hash value.

[0102] In some cases, since the bytes of K items of information are large, directly calculating the corresponding hash values ​​of K items of information requires certain computing resources. Therefore, the following embodiment further describes how to reduce the computing resources required for calculating the hash values.

[0103] In a possible implementation, the first session table entry further includes at least one second session table, each second session table includes at least one second key-value pair, for each second key-value pair of a second session table, a key of the second key-value pair corresponds to at least part of K items of information in the second tuple, a value of the second key-value pair corresponds to the first encoded value, and a set of information of the at least one second session table includes the K items of information in the second tuple;

[0104] Determining first hash values ​​corresponding to K items of information in a first tuple includes:

[0105] Matching the K items of information in the first tuple with the second key-value pairs in each second session table to determine a target code value group corresponding to the K items of information in the first tuple;

[0106] A first hash value corresponding to K items of information in the first tuple is determined based on the target code value group.

[0107] In this embodiment, the second session table may be one or more. The target code value group includes at least one target code value. Optionally, the number of target code values ​​in the target code value group may be consistent with the number of the second session table. Specifically, the bytes of at least part of the K items of information are greater than the bytes of the code values ​​corresponding to at least part of the K items of information. Accordingly, the computing resources required to calculate the hash value based on the code values ​​corresponding to at least part of the K items of information are less than the computing resources required to calculate the hash value based on at least part of the K items of information. Matching the K items of information in the first tuple with the second key-value pairs in each second session table may be matching the specific content of the K items of information in the first tuple with the key of the second key-value pair in each second session table, and if the key of the second key-value pair is consistent with part or all of the content of the K items of information in the first tuple, the match is successful. If the key of the second key-value pair is inconsistent with part or all of the content of the K items of information in the first tuple, the match fails.

[0108] Exemplarily, taking the second session table as an example, the key in the second key-value pair in the second session table corresponds to K items of information.

[0109] Please refer to Table 4, which is a schematic diagram of a second session table provided in an embodiment of the present application. As shown in Table 4, the key of the second key-value pair of a second session table corresponds to K items of information, and the value of the second key-value pair of the second session table corresponds to the first encoding value. In this embodiment, if the key of the second key-value pair is successfully matched, the first encoding value corresponding to the value of the successfully matched second key-value pair is used as at least part of the target encoding value group.

[0110] Table 4

[0111]

[0112] Among them, Inside id and Nat id can represent the first coding value.

[0113] Taking the case where there are at least two second session tables, the key of the second key-value pair in one of the second session tables may correspond to a part of the K items of information, wherein the key of the second key-value pair in another second session table may correspond to the other half of the K items of information. For example, the key of the second key-value pair in one second session table may correspond to the destination IP address and the destination port, and the key of the second key-value pair in another second session table may correspond to the transport layer protocol and the source IP address, and this is not limited here.

[0114] Optionally, the public IP and the intranet IP can be stored in the same session table. The public port and the intranet port can also be stored in the same session table.

[0115] The technical solution of this embodiment is to match the K items of information in the first tuple with the second key-value pairs in each second session table to determine the target code value group corresponding to the K items of information in the first tuple; determine the first hash value corresponding to the K items of information in the first tuple based on the target code value group, because at least part of the bytes of the K items of information are larger than the bytes of the code value corresponding to at least part of the K items of information. Accordingly, the computing resources required to calculate the hash value based on the code value corresponding to at least part of the K items of information are smaller than the computing resources required to calculate the hash value based on at least part of the K items of information, thereby reducing the computing resources required to calculate the hash value, thereby reducing the computing resources required to determine the forwarding information.

[0116] In one possible implementation, at least one second session table includes a first session sub-table and a second session sub-table, the key of the second key-value pair of the first session sub-table corresponds to M items of information among the K items of information in the second tuple, the key of each second key-value pair of the second session sub-table corresponds to KM items of information among the K items of information in the second tuple, and 1≤M<K.

[0117] Please refer to Table 5 and Table 6. Table 5 is a schematic diagram of a first conversation sub-table provided in an embodiment of the present application. Table 6 is a schematic diagram of a second conversation sub-table provided in an embodiment of the present application. As shown in Table 5, the key of the second key-value pair of the first conversation sub-table corresponds to the destination IP address and the destination port, and the value of the second key-value pair of the first conversation sub-table corresponds to the first coding value. The key of the second key-value pair of the second conversation sub-table corresponds to the transport layer protocol and the source IP address, and the value of the second key-value pair of the second conversation sub-table corresponds to the first coding value. Optionally, the first coding value of the first conversation sub-table and the first coding value of the second conversation sub-table may be the same or different, and may be set as needed, without limitation herein.

[0118] Table 5

[0119]

[0120] Table 6

[0121]

[0122] Accordingly, the K items of information in the first tuple are matched with the second key-value pairs in each second session table to determine the target code value group corresponding to the K items of information in the first tuple, including:

[0123] Matching the M items of information in the first tuple with the second key-value pair of the first session subtable, and matching the KM items of information in the first tuple with the second key-value pair of the second session subtable;

[0124] If a match is successful with one of the second key-value pairs in the first session sub-table and one of the second key-value pairs in the second session sub-table, a first target encoding value and a second target encoding value are obtained, where the first target encoding value is an encoding value corresponding to the value of the successfully matched second key-value pair in the first session sub-table, and the second target encoding value is an encoding value corresponding to the value of the successfully matched second key-value pair in the second session sub-table;

[0125] The first target coded value and the second target coded value are taken as at least part of a target coded value group.

[0126] In this embodiment, if the specific content of the M items of information in the first tuple is consistent with the specific content of the M items of information corresponding to the key in the second key-value pair of the first conversation subtable, the first conversation subtable is matched successfully; if the specific content of the M items of information in the first tuple is inconsistent with the specific content of the M items of information corresponding to the key in the second key-value pair of the first conversation subtable, the first conversation subtable is matched unsuccessfully. If the specific content of the KM items of information in the first tuple is consistent with the specific content of the KM items of information in the second conversation subtable, the match is successful; if the specific content of the KM items of information in the first tuple is inconsistent with the specific content of the KM items of information in the second conversation subtable, the match is unsuccessful.

[0127] The technical solution of this embodiment is to set at least two second session tables, one of which may be a first session sub-table, and the other of which may be a second session sub-table, wherein the key of the second key-value pair of the first session sub-table corresponds to M items of information in the K items of information in the second tuple, and the key of each second key-value pair of the second session sub-table corresponds to KM items of information in the K items of information in the second tuple, and if the match with one of the second key-value pairs of the first session sub-table and one of the second key-value pairs of the second session sub-table is successful, then obtain a first target encoding value and a second target encoding value, the first target encoding value being an encoding value corresponding to the value of the successfully matched second key-value pair of the first session sub-table, and the second target encoding value being an encoding value corresponding to the value of the successfully matched second key-value pair of the second session sub-table; and use the first target encoding value and the second target encoding value as at least part of the target encoding value group, because tuples with the same M items of information can share a pair of second key-value pairs, and tuples with the same KM items of information can share a pair of second key-value pairs, thereby reducing the number of second key-value pairs, reducing the on-chip storage space occupied by the second session table, and further improving the scale of state sessions supported.

[0128] In a possible implementation, the method further includes at least one of the following:

[0129] If the match with any second key-value pair of the first session sub-table fails, the preset invalid code value is used as the first target code value or the first data packet is sent to the first chip;

[0130] If the match with any second key-value pair in the second session sub-table fails, the preset invalid code value is used as the second target code value or the first data packet is sent to the first chip.

[0131] In this embodiment, if the match with any second key-value pair of the first session sub-table fails, the preset invalid code value is used as the first target code value, and the first target code value is an invalid code value, and the hash value determined based on the invalid code value is also invalid, and the match cannot be successful, thereby triggering the first data packet to be sent to the first chip. Similarly, if the match with any second key-value pair of the second session sub-table fails, the preset invalid code value is used as the second target code value, and the second target code value is an invalid code value, and the hash value determined based on the invalid code value is also invalid, and the match cannot be successful, thereby triggering the first data packet to be sent to the first chip. In addition, if the match with any second key-value pair of the first session sub-table fails or the match with any second key-value pair of the second session sub-table fails, the first data packet can also be directly sent to the first chip to reduce the amount of calculation.

[0132] It should be noted that in some cases, when the scale of supported state sessions is large, hash value conflicts may occur between different tuples. At this time, if the conflicting hash values ​​are saved in the first session table, inaccurate forwarding information may be determined. If the conflicting hash values ​​are deleted, the scale of supported state sessions will be limited.

[0133] Therefore, in a possible implementation, there are at least two first session tables, the at least two first session tables correspond one-to-one to the at least two hash functions, and for each first session table in the at least two first session tables, the second hash value corresponding to the key of the first key-value pair of the first session table is determined based on the hash function corresponding to the first session table;

[0134] Determining first hash values ​​corresponding to K items of information in a first tuple based on a target code value group includes:

[0135] Compressing the target code value group based on each hash function of at least two hash functions to obtain a first hash value corresponding to each hash function;

[0136] Matching the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table includes:

[0137] The first hash value corresponding to each hash function and the LK item information of the first tuple information are matched with the first key-value pair of the first session table corresponding to each hash function.

[0138] In this embodiment, the at least two hash functions may include but are not limited to at least two of CRC16, CRC32 or CRC64, etc., which are not limited here. Optionally, any two hash values ​​in the at least two first session tables are different, that is, any two hash values ​​in the same first session table are different, and any two hash values ​​in different first session tables are also different.

[0139] The technical solution of this embodiment compresses the target code value group based on each hash function of at least two hash functions to obtain the first hash value corresponding to each hash function; the first hash value corresponding to each hash function and the LK item information of the first multi-tuple information are matched with the first key-value pair of the first session table corresponding to each hash function, and there are at least two first session tables, and the at least two first session tables correspond to the at least two hash functions one by one. For each first session table in the at least two first session tables, the second hash value corresponding to the key of the first key-value pair of the first session table is determined based on the hash function corresponding to the first session table, thereby reducing the situation of hash conflicts, thereby ensuring the supported state session scale and the accuracy of determining the forwarding information.

[0140] It should be noted that the setting of the LK information may affect the state session scale. Therefore, in a possible implementation, the LK item information in the first session table is determined in the following manner:

[0141] Acquire multiple forwarded second data packets;

[0142] For each second data packet, extract a second tuple from a data packet header of the second data packet, the second tuple including a source protocol address, a source port, a protocol, a destination protocol address, and a destination port;

[0143] Determine, based on the second tuple corresponding to each second data packet, a first maximum number of occurrences of a same source address, a second maximum number of occurrences of a same source port, a third maximum number of occurrences of a same protocol, a fourth maximum number of occurrences of a same destination protocol address, and a fifth maximum number of occurrences of a same destination port in the plurality of second data packets;

[0144] determining a maximum of a first maximum number of occurrences, a second maximum number of occurrences, a third maximum number of occurrences, a fourth maximum number of occurrences, and a fifth maximum number of occurrences;

[0145] An item of information corresponding to the maximum value in the second multi-tuple is determined as the LK item of information in the first session table.

[0146] In this embodiment, illustratively, it is assumed that the second tuples in the plurality of second data packets are respectively as follows:

[0147] 192.168.1.1 10000 TCP 121.14.88.76 80;

[0148] 192.168.1.1 10001 TCP 121.14.88.76 81;

[0149] 192.168.1.1 10000 UDP (User Datagram Protocol) 121.14.88.77 80.

[0150] From this we can see that the source IP address 192.168.1.1 appears the most times: 3 times; the source port 10000 appears the most times: 2 times; the transport layer protocol TCP appears the most times: 2 times; the destination IP address 121.14.88.76 appears the most times: 2 times; the destination port 80 appears the most times: 2 times. The source IP address appears the most times, so the source IP address can be used as the LK item information.

[0151] The technical solution of this embodiment is as follows: by acquiring multiple forwarded second data packets; for each second data packet, extracting a second tuple from the data packet header of the second data packet, the second tuple including a source protocol address, a source port, a protocol, a destination protocol address and a destination port; determining, based on the second tuple corresponding to each second data packet, a first maximum number of occurrences of the same source address, a second maximum number of occurrences of the same source port, a third maximum number of occurrences of the same protocol, a fourth maximum number of occurrences of the same destination protocol address and a fifth maximum number of occurrences of the same destination port in the multiple second data packets; determining a maximum value among the first maximum number of occurrences, the second maximum number of occurrences, the third maximum number of occurrences, the fourth maximum number of occurrences and the fifth maximum number of occurrences; determining an item of information corresponding to the maximum value in the second tuple as LK item information in the first session table, that is, selecting information that is prone to have the same value as LK item information stored in the first session table, thereby reducing the bytes of the first session table, so that the first session table can store more first key-value pairs.

[0152] It should be noted that, in the above embodiments, it is mentioned that the first forwarding indication information may include the first forwarding indication sub-information and the second forwarding indication sub-information. Specifically, the first forwarding indication sub-information may be a unique ID (code, Identity document) value used to determine the first forwarding information or the first forwarding information itself, and similarly, the second forwarding indication sub-information may be a code value used to determine the second forwarding information or the second forwarding message itself.

[0153] However, if the first forwarding indication sub-information is the first forwarding information itself and the second forwarding indication sub-information is the second forwarding information itself, then the first session table stores more content and occupies more bytes. If the first forwarding indication sub-information is a unique ID for determining the first forwarding information and the second forwarding indication sub-information is a unique ID for determining the second forwarding information, then the first forwarding information and the second forwarding information can be searched through the third session table based on the unique ID for determining the first forwarding information and the unique ID for determining the second forwarding information. However, for the third session table, the content stored is more and the bytes occupied are larger.

[0154] Therefore, in a possible implementation manner, the forwarding information includes first forwarding information and second forwarding information, the first forwarding indication information includes the second encoding value and the second forwarding information, the first session table entry also includes a third session table, the third session table includes at least one third key-value pair, and for each third key-value pair, the key of the third key-value pair corresponds to the third encoding value, and the value of the third key-value pair corresponds to the first forwarding information;

[0155] Determining target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the first key-value pair that successfully matches includes:

[0156] Matching the first code value corresponding to the value of the first key-value pair that matches successfully with the third key-value pair of the third session table;

[0157] If a match is successful with one of the third key-value pairs, the first forwarding information corresponding to the value of the successfully matched third key-value pair and the second forwarding information corresponding to the value of the successfully matched first key-value pair are determined as at least part of the target forwarding information of the first data packet;

[0158] If the match with any third key-value pair fails, the first data packet is discarded.

[0159] Please refer to Table 7, which is a schematic diagram of a third session table provided in an embodiment of the present application. As shown in Table 7, the key of the third key-value pair of the third session table corresponds to the third encoding value, and the value of the third key-value pair corresponds to the first forwarding information.

[0160] Table 7

[0161]

[0162] In this embodiment, the first coded value corresponding to the value of the successfully matched first key-value pair is matched with the third key-value pair of the third session table. The first coded value corresponding to the value of the successfully matched first key-value pair is matched with the key of each third key-value pair. If the first coded value corresponding to the value of the successfully matched first key-value pair is consistent with the specific content of the key of one of the third key-value pairs, the match is successful. If the first coded value corresponding to the value of the successfully matched first key-value pair is inconsistent with the specific content of the value of any third key-value pair, the match fails.

[0163] In the technical solution of this embodiment, the forwarding information includes the first forwarding information and the second forwarding information, the first forwarding indication information includes the second coding value and the second forwarding information, the first coding value corresponding to the value of the successfully matched first key-value pair is matched with the third key-value pair of the third session table; if the match with one of the third key-value pairs is successful, the first forwarding information corresponding to the value of the successfully matched third key-value pair and the second forwarding information corresponding to the value of the successfully matched first key-value pair are determined as at least part of the target forwarding information of the first data packet; if the match with any of the third key-value pairs fails, the first data packet is discarded, because the first session table stores the third coding value and the second forwarding information used to determine the first forwarding information, and then the target forwarding information of the first data packet is determined through the third session table, which can take into account the byte sizes occupied by the first session table and the third session table.

[0164] In a possible implementation, the method further includes:

[0165] If the match with any first key-value pair fails, sending the first data packet to the first chip so that the first chip determines the target forwarding information of the first data packet;

[0166] Obtaining a target session table entry from a second chip;

[0167] updating the first session table entry based on the target session table entry, so that when a new data packet to be forwarded is obtained, forwarding information of the new data packet to be forwarded is determined based on the updated first session table entry;

[0168] The target session table entry includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and the LK item information in the first tuple, the first hash value is a hash value corresponding to the K item information of the first tuple, the value of the fourth key-value pair corresponds to the second forwarding indication information, the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, and the fourth session table is used to update the first session table in the first session table entry.

[0169] The technical solution of this embodiment, by sending the first data packet to the first chip when the match with any first key-value pair fails, so that the first chip determines the target forwarding information of the first data packet, can ensure the success rate of determining the forwarding information, thereby improving the session scale. In addition, the target session table item from the second chip is obtained; the first session table item is updated based on the target session table item, so that when a new data packet to be forwarded is obtained, the forwarding information of the new data packet to be forwarded is determined based on the updated first session table item, so that the next time a data packet carrying the first five-tuple is received, the first chip can determine the forwarding information based on the preset first session table item.

[0170] In some cases of the examples, since the on-chip storage space of the second chip is limited, it may not be possible to store the key-value pairs corresponding to all the five-tuples. Therefore, in a possible implementation, when the remaining on-chip storage space is less than a preset remaining storage space threshold, the number of successful matches of the key-value pairs corresponding to each five-tuple of the first session table item can be obtained, and the key-value pairs corresponding to one or more five-tuples with the smallest number of successful matches are deleted from the first session table item to release part of the storage space while minimizing the impact on the determination of the forwarding information.

[0171] In addition, when the remaining storage space on the chip is less than a preset remaining storage space threshold and a target session table entry from the first chip is received, the number of successful matches of the key-value pairs corresponding to each quintuple of the first session table entry is obtained, and the key-value pairs corresponding to one or more quintuples with the smallest number of successful matches are deleted from the first session table entry, which is not limited here.

[0172] It should be noted that, in the embodiment of the present application, the coding value in a session table may be unique. The coding values ​​of different session tables may be unique or non-unique, and may be set as required, which is not limited here.

[0173] See also Figure 3 , Figure 3 A schematic diagram of a process of matching a first session table entry provided in an embodiment of the present application. In this embodiment, the first session table entry includes the format of the first session table shown in Table 2, the format of the first session sub-table shown in Table 5, the format of the second session sub-table shown in Table 6, and the format of the third session table shown in Table 7 for example.

[0174] like Figure 3As shown, the destination IP address and the destination port in the first tuple can be used to search for a matching second key-value pair from the first session subtable, and the protocol and the source IP address in the first tuple can be used to search for a matching second key-value pair from the second session subtable. If both the first session subtable and the second session subtable are successfully matched, a set of target code value groups can be obtained. Then, the first hash value is calculated using the target code value group, and then the first hash value and the source port are used to search for a matching first key-value pair from the first session table. If the first key-value pair is successfully matched, the second code value corresponding to the value of the successfully matched first key-value pair is matched with the third key-value pair of the third session table, so that if the match is successful, the target forwarding information of the first data packet is determined based on the second forwarding information corresponding to the successfully matched first key-value pair and the first forwarding information corresponding to the successfully matched third key-value pair.

[0175] See also Figure 4 , Figure 4 A flowchart of another method for determining forwarding information provided in an embodiment of the present application. Figure 4 The method shown can be executed by the first chip. Figure 4 The methods shown may include:

[0176] S410: Acquire a first data packet from a second chip.

[0177] In this embodiment, the first data packet received by the first chip may be sent by the second chip when the set conditions are met. The set conditions may include but are not limited to at least one of failure to match any first key-value pair, failure to match any second key-value pair in the first session sub-table, or failure to match any second key-value pair in the second session sub-table.

[0178] S420: Extract a first tuple from a data packet header of a first data packet.

[0179] S430: Search for a target session entry corresponding to the first tuple from the preset second session entries.

[0180] The second session table entry may be a session table entry preset by the first chip. The target session table entry includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and LK items of information in the first tuple, the first hash value is a hash value corresponding to K items of information in the first tuple, the value of the fourth key-value pair corresponds to second forwarding indication information, and the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, wherein 1≤K<L, and L represents the total number of information items in the tuple.

[0181] Optionally, the target forwarding information may include first target forwarding information and second target forwarding information. Then the second forwarding indication information may include third forwarding indication sub-information and fourth forwarding indication sub-information. The third forwarding indication sub-information may be the first target forwarding information itself or a unique coding value used to determine the first target forwarding information. The fourth forwarding indication sub-information may be the second target forwarding information itself or a unique coding value used to determine the second target forwarding information.

[0182] S440: If the target session entry is successfully searched, determine the target forwarding information of the first data packet based on the target session entry, and send the target session entry to the second chip, so that the second chip updates the preset first session entry based on the target session entry.

[0183] The fourth session table is used to update the first session table in the first session table item. In this embodiment, the target session table item corresponding to the first tuple has not been sent to the second chip, so the second chip cannot determine the target forwarding information of the first data packet. Therefore, the target session table item corresponding to the first tuple can be searched from the preset second session table item first. If the target session table item can be found, the target forwarding information can be determined based on the target session table item based on the matching method of the above embodiment. At the same time, the target session table item is sent to the second chip, so that the second chip updates the preset first session table item based on the target session table item. Then, when the second chip receives a new data packet to be forwarded, it can determine the forwarding information of the new data packet to be forwarded based on the updated first session table item.

[0184] It is understandable that the fourth session table may refer to the formats of Table 1 to Table 3, which are not limited here.

[0185] The technical solution of this embodiment obtains a first data packet from the second chip; extracts a first tuple from a data packet header of the first data packet; searches for a target session table item corresponding to the first tuple from a preset second session table item, and if the target session table item is successfully searched, determines target forwarding information of the first data packet based on the target session table item, and sends the target session table item to the second chip, so that the second chip updates the preset first session table item based on the target session table item, thereby improving the success rate of determining the forwarding information.

[0186] In a possible implementation, the target session table entry further includes at least one item in at least one fifth session table or a sixth session table, wherein the fifth session table is used to update the second session table in the first session table entry, and the sixth session table is used to update the third session table in the first session table entry;

[0187] Each fifth session table includes a fifth key-value pair. For the fifth key-value pair of a fifth session table, the key of the fifth key-value pair corresponds to at least part of the K items of information in the first tuple, the value of the fifth key-value pair corresponds to the target encoding value, and the set of information of at least one fifth session table includes the K items of information in the first tuple.

[0188] In this embodiment, the target code value is determined based on at least part of the K items of information in the first tuple. Specifically, the bytes occupied by the target code value corresponding to at least part of the K items of information are smaller than the bytes occupied by at least part of the K items of information.

[0189] It is understandable that the format of the fifth session table can refer to the format description of the second session table, which will not be described in detail here.

[0190] The target forwarding information includes first target forwarding information and second target forwarding information, the second forwarding indication information includes a fourth encoding value and the second target forwarding information, the sixth session table includes a sixth key-value pair, the key of the sixth key-value pair corresponds to the fourth encoding value, and the value of the sixth key-value pair corresponds to the first target forwarding information.

[0191] In this embodiment, the fourth code value may be determined according to the first target forwarding information. The bytes occupied by the fourth code value are smaller than the bytes occupied by the first target forwarding information.

[0192] It is understandable that the format of the sixth session table may refer to the format description of the third session table, which will not be described in detail here.

[0193] In a possible implementation, the fifth session table includes a third session sub-table and a fourth session sub-table, the key in the fifth key-value pair of the third session sub-table corresponds to M items of information in the K items of information in the first tuple, the value in the fifth key-value pair of the third session sub-table corresponds to the first target encoding value, the key in the fifth key-value pair of the fourth session sub-table corresponds to the KM items of information in the first tuple, the value in the fifth key-value pair of the fourth session sub-table corresponds to the second target encoding value, and 1≤M<K;

[0194] The third session sub-table is used to update the first session sub-table in the second session table, and the fourth session sub-table is used to update the second session sub-table in the second session table.

[0195] In this embodiment, the bytes occupied by the first target code value are smaller than the bytes occupied by the M items of information. The bytes occupied by the second target code value are smaller than the bytes occupied by the KM items of information.

[0196] It is understandable that the format of the third conversation sub-table can refer to the format description of the first conversation sub-table, and the format description of the fourth conversation sub-table can refer to the format description of the second conversation sub-table, which will not be elaborated here.

[0197] See also Figure 5 , Figure 5 A schematic diagram of a process for generating a target session table entry is provided in an embodiment of the present application. In this embodiment, the first session table entry includes the format of the first session table shown in Table 2, the format of the first session sub-table shown in Table 5, the format of the second session sub-table shown in Table 6, and the format of the third session table shown in Table 7.

[0198] like Figure 5 As shown, the target forwarding information corresponding to the first quintuple can be determined first, and the target forwarding information includes the first target forwarding information and the second target forwarding information. Then, based on the relationship between the first forwarding information and the encoding value, the encoding value corresponding to the first target forwarding information can be determined, and then the sixth session table can be generated. Then, the first target encoding value corresponding to the M items of information of the first quintuple is allocated, and the second target encoding value corresponding to the KM items of information of the first quintuple is allocated, and then the third session sub-table and the fourth session sub-table can be generated. Then, based on the target encoding value group including the first target encoding value and the second target encoding value, the first hash value is calculated, and then the fourth session table can be generated.

[0199] It should be noted that a fourth session table corresponding to each of at least two hash functions may be generated.

[0200] In a possible implementation, if the query of the target session entry fails, the method further includes:

[0201] Assigning target code value groups corresponding to K items of information in the first multi-group;

[0202] Obtaining a hash collision result, the hash collision result representing a candidate code value group corresponding to each of the at least two hash functions, wherein, for each hash function, any two candidate code value groups corresponding to the hash function have different hash values ​​determined based on the hash function;

[0203] If the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, assigning target forwarding information of the first data packet, generating a target session table entry based on the target forwarding information, and sending the target session table entry to the second chip;

[0204] The first hash value corresponding to the key in the fourth key-value pair of the fourth session table is obtained by compressing the target code value group based on a hash function corresponding to the candidate code value group that is the same as the target code value group.

[0205] In this embodiment, if the query of the target session table entry fails, it means that the first chip has not yet generated the target session table entry corresponding to the first multi-tuple. The target code value group can be one of the candidate code value groups. Since the candidate code value group can be determined in advance, the hash collision result can be determined in an offline state, that is, before determining the forwarding information, so as to determine which hash function is used to calculate the hash value of each candidate code group.

[0206] Specifically, if the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, it means that the target code value group will not have a hash conflict, and therefore, the target session entry can be generated based on the target forwarding information.

[0207] The technical solution of this embodiment is to allocate a target code value group corresponding to K items of information in a first multi-group; obtain a hash collision result, the hash collision result characterizing a candidate code value group corresponding to each hash function of at least two hash functions, wherein, for each hash function, any two candidate code value groups corresponding to the hash function are different based on the hash values ​​determined by the hash function; if the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, allocate the target forwarding information of the first data packet, generate a target session table entry based on the target forwarding information, and send the target session table entry to the second chip, so that the target session table entry can be generated while avoiding hash collisions, thereby improving the success rate and accuracy of determining the forwarding information of the data packet.

[0208] It should be noted that the first session table entry and the second session table entry can be stored in the first forwarding path, and the forwarding information can be determined through the first forwarding path, thereby forwarding the data packet. Optionally, if the target code value group is different from the candidate code value group corresponding to any hash function, it means that the target code value group will not have a hash conflict, so the data packet can be forwarded based on the second forwarding path. Specifically, the forwarding speed of the first forwarding path is higher than that of the second forwarding path, that is, the first forwarding path is a fast path and the second forwarding path is a slow path, thereby taking into account both the speed and success rate of data packet forwarding.

[0209] In one possible implementation, the hash collision result is obtained in the following way:

[0210] Obtain multiple candidate encoding value groups;

[0211] Performing hash conflict resolution processing on multiple candidate code value groups by using at least two hash functions until an end condition is satisfied, thereby obtaining a hash conflict result;

[0212] Among them, hash conflict resolution processing includes:

[0213] Compressing each candidate code value group in the plurality of candidate code value groups by using one of the hash functions to obtain a hash value corresponding to each candidate code value group;

[0214] If the hash value corresponding to one of the candidate code value groups is different from the hash value corresponding to any other candidate code value group among the multiple candidate code value groups, then one of the candidate code value groups is used as the candidate code value group corresponding to one of the hash functions, and the other candidate code value groups are the candidate code value groups other than one of the candidate code value groups;

[0215] If the hash values ​​corresponding to at least two of the candidate code value groups are the same, compressing the at least two candidate code value groups with the same hash value by another hash function;

[0216] The termination condition includes at least one of the following:

[0217] One hash function among at least two hash functions corresponding to each candidate code group in a plurality of candidate code value groups;

[0218] A hash collision resolution process has been performed by any one of at least two hash functions.

[0219] See also Figure 6-Figure 8 , Figure 6-Figure 8 A schematic diagram of a process for resolving hash conflicts provided in an embodiment of the present application.

[0220] like Figure 6 As shown, the hash function includes hash function 1, hash function 2 and hash function 3. In the first session table corresponding to hash function 1, one or more candidate code value groups without hash collision are included. And the first session table corresponding to hash function 2 also includes one or more candidate code value groups without hash collision. Among them, "()" represents a group of candidate code value groups, and the value in "()" is the value in the candidate code value group, and "H()" can represent the hash value corresponding to the candidate code value group.

[0221] At this time, if there are two new candidate encoding value groups to be assigned to the first session table, then Figure 7 As shown, two new candidate coding groups are calculated using hash function 1. If it is found that the hash values ​​calculated by hash function 1 for the two new candidate coding groups are the same, then the two candidate coding value groups cannot be stored in the first session table corresponding to hash function 1.

[0222] At this time, if Figure 8 As shown, the two new candidate code value groups are calculated by hash function 2. If the hash values ​​corresponding to the two new candidate code value groups calculated by hash function 2 are different, the two new candidate code value groups can be stored in the first session table corresponding to hash function 2.

[0223] In the technical solution of this embodiment, the candidate encoding value group can be determined in advance, and the hash collision result can be determined before determining the forwarding information, and the target session table entry can be directly generated based on the hash collision result, thereby improving the efficiency of generating the target session table entry.

[0224] For ease of understanding, the following embodiments are described by taking the gateway as a NAT gateway as an example. The NAT gateway may include a white box programmable switch. The switch has the ability to modify the data packet forwarding logic as needed. The switch can accept data packets sent from different devices (such as servers and other switches, etc.), and can also forward data packets according to the business orchestration logic requirements. In the scenario of this embodiment, the stateful gateway is mainly responsible for the NAT gateway for converting the internal and external network IP addresses. Its core task is to map the internal network IP and port of the computer room to the same public network IP and different ports, thereby converging the public network IP and saving the public network IP cost. In the related art, the implementation method of the NAT state gateway based on the programmable switch is to directly store the five-tuple information and the corresponding mapped public network IP and port information as table elements in the state Session table item, which occupies a large amount of on-chip storage space of the programmable switch, making the state Session scale that can be supported very limited. In order to increase the scale of state sessions, some solutions use hash-based algorithms to compress the Session Key field into a shorter field. However, due to the possibility of conflicts when using hash functions, existing solutions rely on the TCP first-flow marker segment to resolve hash conflicts, and the traffic model scenarios are limited.

[0225] In general, the embodiments of the present application solve the technical problem in the following ways:

[0226] 1. Taking NAT gateway as an example, the original 5-tuple session table is split into 3 tables: pre-session table (second session table). The pre-session table can include out table (first session sub-table) and nat&intable (second session sub-table), sessioni table (first session table), and post-session table (third session table). The post-session table is also called map table. The purpose of dividing into the above 3 tables is to unload the fields with less frequent occurrence in the existing 5-tuple fields (source IP address src_ip, destination IP address dst_ip, source port src_port, destination port dst_port, protocol protocol) into small table items, and obtain two beneficial effects: first, the field length of the session table can be as small as possible; second, the pre-session table can use one stage to complete the unloading of small table items as much as possible. The selection of unloading 5-tuple fields in the above 3 table items can be based on business needs, but the final condition that needs to be met is that the key field in the pre-session table and session table must contain all 5-tuple fields and cannot be repeated. 2. Use hash algorithm to further compress the field in the key of session table. For example, in the above, outside id (2B) and inside id (1B) are compressed into hash (x) (2B). 3. For potential hash conflicts, since the value range of out table value and nat&in table value can be determined in advance, we can filter out possible conflicting id combinations offline and use multiple hash functions to resolve the conflicts. 4. The method of resolving conflicts using multiple hash functions is: when it is found that the results of two groups of input ids using hash function hash1 are the same, the two groups of inputs are calculated using hash function hash2. In most cases, these two groups of inputs will produce different hash results. 5. If multiple hash functions are used and the conflict cannot be effectively resolved, the group of ids will not be unloaded to the fast path, but only forwarded in the slow path.

[0227] See also Fig. 9 , Fig. 9 A flowchart of another method for determining forwarding information provided in an embodiment of the present application. Fig. 9 The method shown can be performed by the first chip and the second chip. Fig. 9 The methods shown may include:

[0228] S901. After receiving a data packet, the second chip extracts field information from the data packet header for use in subsequent table entry query.

[0229] The data extracted in this embodiment may be, for example, 5-tuple information of a data packet (source IP address src_ip, destination IP address dst_ip, source port src_port, destination port dst_port, protocol protocol).

[0230] S902: The second chip queries the first table entry pre-session table1 to determine whether the destination address dst_ip and the destination port dst_port of the 5-tuple have corresponding pre-stored IP information, and stores it in corresponding fields.

[0231] If pre-session table1 is matched, the process jumps to step a); otherwise, the process jumps to step b):

[0232] a) Update the oid_final field according to the oid information queried from pre-session table1, and jump to step S903;

[0233] b) If no oid information is found, set oid_final to the initial value, that is, oid_final = -1.

[0234] S903: The second chip queries pre-session table 2 to determine whether there is matching table entry information between the protocol protocol and the source IP address src_ip.

[0235] If pre-session table2 is hit, jump to step a); otherwise jump to step b):

[0236] a) query the iid information according to pre-session table2, update the iid_final field, and jump to step S904);

[0237] b) If no iid information is found, iid_final is set to the initial value, i.e., iid_final=-1.

[0238] Among them, pre-session table1 can be the first session sub-table, and pre-session table2 can be the second session sub-table.

[0239] S904: The second chip performs hash calculation on the oid_final and iid_final found above to obtain a shorter field hash_id.

[0240] The hash algorithm can be a typical open source algorithm, such as CRC16, CRC32, CRC64, etc., and the length of the output hash field is different. In order to improve the compression efficiency, this solution takes CRC16 as an example, and can map oid_final (2Bytes) and iid_final (1Bytes) into a new hash field hash_id (2Bytes).

[0241] S905: The second chip substitutes the obtained hash_id and source port src_port into the session table for query.

[0242] If it hits, jump to step a); otherwise jump to step b):

[0243] a) According to the NID and NAT port information found in the table, set nid_final=NID, nat_port=NATport, jump to step S906, and query the post-session table;

[0244] b) If no session table information is found, the data packet is sent to the CPU for slow path processing, and the process goes to step S907;

[0245] S906. The second chip converts the source IP and source port of the data packet into nat_ip and nat_port respectively after setting nat_ip=NAT IP according to the NAT IP information obtained by the query.

[0246] Then, jump to step S907; otherwise, if no entry in the post-session table is found, the data packet is discarded and jump to step S908;

[0247] S907: The second chip performs necessary encapsulation on the data packet and then forwards the data packet.

[0248] S908: The second chip sends the data packet to the first chip and ends processing of the current data packet.

[0249] S909: The first chip detects the data packet sent from the second chip, extracts quintuple information of the data packet, and queries whether the quintuple has a corresponding fourth session table in the fully connected table in the memory of the first chip.

[0250] If it hits, jump to step f); if it doesn’t hit, jump to step a):

[0251] S910: The first chip creates corresponding session information for the five-tuple information, and determines the session table location to be unloaded according to the hash conflict result resolved offline.

[0252] Different stages place different hash function calculation results; if the 5-tuple does not have a fast path unload result, the 5-tuple is judged as a data flow that cannot resolve the conflict and is forwarded on the slow path. If it is judged as a data flow that can resolve the conflict, the following steps can be performed:

[0253] a) The newly created session information needs to be inserted into the fully connected table entry, and the pre-sessiontable1, pre-session table2, session table, and post-session table information are simultaneously sent to the fast path table entry;

[0254] b) The entry of pre-session table1 contains the key of destination address dst_ip and destination port dst_port, and the corresponding queried value is oid;

[0255] c) The entry of pre-session table2 contains the key protocol and source IP address src_ip, and the corresponding value is iid;

[0256] d) The entry of the session table contains the key hash_id, the source port src_port, the corresponding queried value nid, and the port nat_port after nat conversion;

[0257] e) The post-session table entry contains the key nid and the value nat_addr, the address after the nat conversion.

[0258] S911. The first chip updates the five-tuple information according to the nat_ip and nat_port information found in the full connection table, and sends the found new session table entry to the second chip.

[0259] Among them, if it is a data packet from the public network to the intranet, replace dst_ip and dst_port with nat_ip and nat_port respectively; if it is a data packet from the intranet to the public network, replace src_ip and src_port with nat_ip and nat_port respectively.

[0260] S912: End the operation logic of the first chip.

[0261] The technical solution of this embodiment has beneficial effects including but not limited to the following technical effects:

[0262] 1. Reduce hash conflicts: The algorithm solves hash conflicts by offloading state table entries, thereby improving the efficiency of query and storage.

[0263] 2. Applicable to various transmission protocol types, not limited to existing TCP streams;

[0264] 3. Optimize storage space: By unloading infrequently used or redundant state table entries, storage space can be effectively optimized.

[0265] 4. Improve data consistency: This algorithm can ensure data consistency because each table entry has a unique hash value.

[0266] 5. Improve scalability: The hash conflict resolution algorithm based on state table item offloading can be easily expanded to adapt to larger data sets.

[0267] 6. Improve network stability: By effectively resolving hash conflicts, the stability of the network can be improved and network delays or interruptions caused by conflicts can be reduced.

[0268] See also Fig.10 , Fig.10 A schematic diagram of the structure of a device for determining forwarding information provided in an embodiment of the present application. Fig.10 The device 1000 shown can be applied to a second chip. Fig.10 The device 1000 shown may include a first acquisition module 1010, a first extraction module 1020, a second acquisition module 1030 and a first determination module 1040, wherein:

[0269] The first acquisition module 1010 is used to acquire a first data packet to be forwarded; the first extraction module 1020 is used to extract a first tuple from a data packet header of the first data packet; the second acquisition module 1030 is used to acquire a preset first session table entry and determine a first hash value corresponding to K items of information in the first tuple, 1≤K<L, L represents the total number of information items in the tuple, the first session table entry includes a first session table, the first session table includes at least one first key-value pair, for each first key-value pair, the key of the first key-value pair corresponds to the second hash value and LK items of information in the second tuple of the forwarded second data packet, the second hash value is the hash value corresponding to the K items of information in the second tuple, the value of the first key-value pair corresponds to first forwarding indication information, and the first forwarding indication information is used to determine forwarding information corresponding to the second tuple; the first determination module 1040 is used to match the first hash value and the LK items of information in the first tuple with the first key-value pair of the first session table; the first determination module 1040 is also used to determine target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the first key-value pair that successfully matches if the match with one of the first key-value pairs is successful.

[0270] Optionally, the first session table entry also includes at least one second session table, each second session table includes at least one second key-value pair, for each second key-value pair of a second session table, the key of the second key-value pair corresponds to at least part of the K items of information in the second tuple, the value of the second key-value pair corresponds to the first code value, and the set of information of at least one second session table includes the K items of information in the second tuple; when determining the first hash value corresponding to the K items of information in the first tuple, the second acquisition module 1030 is used to: match the K items of information in the first tuple with the second key-value pairs in each second session table to determine a target code value group corresponding to the K items of information in the first tuple; and determine the first hash value corresponding to the K items of information in the first tuple based on the target code value group.

[0271] Optionally, at least one second session table includes a first session sub-table and a second session sub-table, the key of the second key-value pair of the first session sub-table corresponds to M items of information in the K items of information in the second tuple, and the key of each second key-value pair of the second session sub-table corresponds to KM items of information in the K items of information in the second tuple, 1≤M<K; when the second acquisition module 1030 matches the K items of information in the first tuple with the second key-value pairs in each second session table to determine the target code value group corresponding to the K items of information in the first tuple, it is used to: match the M items of information in the first tuple with the second key-value pairs of the first session sub-table; The method comprises the steps of: matching the KM item information in the first tuple with the second key-value pair of the second session subtable; if the match is successful with one of the second key-value pairs of the first session subtable and one of the second key-value pairs of the second session subtable, obtaining a first target coding value and a second target coding value, the first target coding value being a coding value corresponding to the value of the successfully matched second key-value pair of the first session subtable, and the second target coding value being a coding value corresponding to the value of the successfully matched second key-value pair of the second session subtable; and using the first target coding value and the second target coding value as at least part of the target coding value group.

[0272] Optionally, the second acquisition module 1030 is also used for at least one of the following: if the match with any second key-value pair of the first session sub-table fails, the preset invalid coding value is used as the first target coding value or the first data packet is sent to the first chip; if the match with any second key-value pair of the second session sub-table fails, the preset invalid coding value is used as the second target coding value or the first data packet is sent to the first chip.

[0273] Optionally, there are at least two first session tables, and the at least two first session tables correspond one-to-one to at least two hash functions. For each of the at least two first session tables, the second hash value corresponding to the key of the first key-value pair of the first session table is determined based on the hash function corresponding to the first session table. When the second acquisition module 1030 determines the first hash value corresponding to the K items of information in the first tuple based on the target code value group, it is used to: compress the target code value group based on each hash function of the at least two hash functions to obtain the first hash value corresponding to each hash function. When the first determination module 1040 matches the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table, it is used to: respectively match the first hash value corresponding to each hash function and the LK item information of the first tuple information with the first key-value pair of the first session table corresponding to each hash function.

[0274] Optionally, the first determination module 1040 is also used to determine the LK item information in the first session table in the following manner: obtain multiple forwarded second data packets; for each second data packet, extract a second tuple from the data packet header of the second data packet, the second tuple including the source protocol address, the source port, the protocol, the destination protocol address and the destination port; based on the second tuple corresponding to each second data packet, determine the first maximum number of occurrences of the same source address, the second maximum number of occurrences of the same source port, the third maximum number of occurrences of the same protocol, the fourth maximum number of occurrences of the same destination protocol address and the fifth maximum number of occurrences of the same destination port in the multiple second data packets; determine the maximum value among the first maximum number of occurrences, the second maximum number of occurrences, the third maximum number of occurrences, the fourth maximum number of occurrences and the fifth maximum number of occurrences; and determine an information item corresponding to the maximum value in the second tuple as the LK item information in the first session table.

[0275] Optionally, the forwarding information includes first forwarding information and second forwarding information, the first forwarding indication information includes a second encoding value and the second forwarding information, the first session table item also includes a third session table, the third session table includes at least one third key-value pair, for each third key-value pair, the key of the third key-value pair corresponds to the third encoding value, and the value of the third key-value pair corresponds to the first forwarding information; when the first determination module 1040 determines the target forwarding information of the first data packet based on the first forwarding indication information corresponding to the value of the first key-value pair that matches successfully, it is used to: match the first encoding value corresponding to the value of the first key-value pair that matches successfully with the third key-value pair of the third session table; if the match with one of the third key-value pairs is successful, the first forwarding information corresponding to the value of the third key-value pair that matches successfully and the second forwarding information corresponding to the value of the first key-value pair that matches successfully are determined as at least part of the target forwarding information of the first data packet; the first determination module 1040 is also used to discard the first data packet if the match with any third key-value pair fails.

[0276] Optionally, the second acquisition module 1030 is further used to: if the match with any first key-value pair fails, send the first data packet to the first chip, so that the first chip determines the target forwarding information of the first data packet; obtain the target session table item from the second chip; update the first session table item based on the target session table item, so that when a new data packet to be forwarded is obtained, the forwarding information of the new data packet to be forwarded is determined based on the updated first session table item; wherein the target session table item includes the target session table item including a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and the LK item information in the first tuple, the first hash value is the hash value corresponding to the K item information of the first tuple, the value of the fourth key-value pair corresponds to the second forwarding indication information, the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, and the fourth session table is used to update the first session table in the first session table item.

[0277] See also Fig.11 , Fig.11 A schematic diagram of the structure of another device for determining forwarding information provided in an embodiment of the present application. Fig.11 The device 1100 shown can be applied to a first chip. Fig.11 The device 1100 shown may include a third acquisition module 1110, a second extraction module 1120, a search module 1130, and a second determination module 1140, wherein:

[0278] The third acquisition module 1110 is used to acquire the first data packet from the second chip; the second extraction module 1120 is used to extract the first tuple from the data packet header of the first data packet; the search module 1130 is used to search for a target session table item corresponding to the first tuple from the preset second session table item, the target session table item includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to the first hash value and LK items of information in the first tuple, the first hash value is a hash value corresponding to K items of information in the first tuple, the value of the fourth key-value pair corresponds to second forwarding indication information, and the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, wherein 1≤K<L, and L represents the total number of information items in the tuple; the second determination module 1140 is used to determine the target forwarding information of the first data packet based on the target session table item if the target session table item search is successful, and send the target session table item to the second chip, so that the second chip updates the preset first session table item based on the target session table item, wherein the fourth session table is used to update the first session table in the first session table item.

[0279] Optionally, the target session table entry further includes at least one item of at least one fifth session table or a sixth session table, wherein the fifth session table is used to update the second session table in the first session table entry, and the sixth session table is used to update the third session table in the first session table entry; each fifth session table includes a fifth key-value pair, and for a fifth key-value pair of a fifth session table, a key of the fifth key-value pair corresponds to at least part of K items of information in the first tuple, and a value of the fifth key-value pair corresponds to a target encoding value, and a set of information of at least one fifth session table includes the K items of information in the first tuple; the target forwarding information includes first target forwarding information and second target forwarding information, the second forwarding indication information includes a fourth encoding value and a second target forwarding information, and the sixth session table includes a sixth key-value pair, a key of the sixth key-value pair corresponds to the fourth encoding value, and a value of the sixth key-value pair corresponds to the first target forwarding information.

[0280] Optionally, the fifth session table includes a third session sub-table and a fourth session sub-table, the key in the fifth key-value pair of the third session sub-table corresponds to M items of information in the K items of information in the first tuple, the value in the fifth key-value pair of the third session sub-table corresponds to the first target coding value, the key in the fifth key-value pair of the fourth session sub-table corresponds to the KM items of information in the first tuple, the value in the fifth key-value pair of the fourth session sub-table corresponds to the second target coding value, 1≤M<K; wherein, the third session sub-table is used to update the first session sub-table in the second session table, and the fourth session sub-table is used to update the second session sub-table in the second session table.

[0281] Optionally, if the query of the target session table item fails, the second determination module 1140 is further used to allocate a target code value group corresponding to the K items of information in the first multi-group; obtain a hash collision result, the hash collision result characterizing a candidate code value group corresponding to each hash function of at least two hash functions, wherein, for each hash function, any two candidate code value groups corresponding to the hash function have different hash values ​​determined based on the hash function; if the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, allocate the target forwarding information of the first data packet, generate a target session table item based on the target forwarding information, and send the target session table item to the second chip; wherein the first hash value corresponding to the key in the fourth key-value pair of the fourth session table is obtained by compressing the target code value group based on the hash function corresponding to the candidate code value group that is the same as the target code value group.

[0282] Optionally, the hash conflict result is obtained by the second determination module 1140 in the following manner: obtaining multiple candidate coding value groups; performing hash conflict resolution processing on the multiple candidate coding value groups through at least two hash functions until the end condition is met to obtain a hash conflict result; wherein the hash conflict resolution processing includes: compressing each candidate coding value group in the multiple candidate coding value groups through one of the hash functions to obtain a hash value corresponding to each candidate coding value group; if the hash value corresponding to one of the candidate coding value groups is different from the hash value corresponding to any other candidate coding value group in the multiple candidate coding value groups, then one of the candidate coding value groups is used as the candidate coding value group corresponding to one of the hash functions, and the other candidate coding groups are candidate coding value groups other than one of the candidate coding value groups; if the hash values ​​corresponding to at least two groups of candidate coding value groups are the same, then compressing at least two groups of candidate coding value groups with the same hash value through another hash function; wherein the end condition includes at least one of the following: one of the at least two hash functions corresponding to each candidate coding value group in the multiple candidate coding value groups; hash conflict resolution processing has been performed through any of the at least two hash functions.

[0283] The device of the embodiments of the present application can execute the method provided by the embodiments of the present application, and the implementation principles are similar. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0284] An embodiment of the present application provides a gateway, including a memory, a processor, and a computer program stored in the memory, and the processor executes the above computer program to implement the steps of the method of any embodiment of the present application.

[0285] In an optional embodiment, a gateway is provided, such as Fig.12 As shown, Fig.12 The gateway 1200 shown includes: a processor 1201 and a memory 1203. The processor 1201 and the memory 1203 are connected, such as through a bus 1202. Optionally, the gateway 1200 may also include a transceiver 1204, which may be used for data interaction between the gateway and other gateways, such as data transmission and / or data reception. It should be noted that in actual applications, the transceiver 1204 is not limited to one, and the structure of the gateway 1200 does not constitute a limitation on the embodiments of the present application.

[0286] Processor 1201 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 1201 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0287] The bus 1202 may include a path to transmit information between the above components. The bus 1202 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 1202 may be divided into a protocol address bus, a data bus, a control bus, etc. For ease of representation, Fig.12 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0288] The memory 1203 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0289] The memory 1203 is used to store the computer program for executing the embodiment of the present application, and the execution is controlled by the processor 1201. The processor 1201 is used to execute the computer program stored in the memory 1203 to implement the steps shown in the above method embodiment.

[0290] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps and corresponding contents of the aforementioned method embodiment can be implemented.

[0291] The embodiment of the present application also provides a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor.

[0292] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios of execution time, the execution order of these sub-steps or stages may be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0293] The above are only optional implementation methods for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the scheme of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A method for determining forwarding information, characterized in that: include: Obtaining a first data packet to be forwarded; extracting a first tuple from a data packet header of the first data packet; Obtain a preset first session table entry, and determine a first hash value corresponding to K items of information in the first tuple, 1≤K<L, L represents the total number of information items in the tuple, the first session table entry includes a first session table, the first session table includes at least one first key-value pair, for each first key-value pair, the key of the first key-value pair corresponds to a second hash value and LK items of information in a second tuple of a forwarded second data packet, the second hash value is a hash value corresponding to the K items of information in the second tuple, the value of the first key-value pair corresponds to first forwarding indication information, and the first forwarding indication information is used to determine forwarding information corresponding to the second tuple; Matching the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table; If a match is successful with one of the first key-value pairs, the target forwarding information of the first data packet is determined based on the first forwarding indication information corresponding to the value of the first key-value pair that is successfully matched.

2. The method according to claim 1, characterized in that The first session table entry further includes at least one second session table, each second session table includes at least one second key-value pair, for each second key-value pair of a second session table, a key of the second key-value pair corresponds to at least part of K items of information in the second tuple, a value of the second key-value pair corresponds to a first encoding value, and a set of information of the at least one second session table includes the K items of information in the second tuple; The determining a first hash value corresponding to K items of information in the first tuple includes: Matching the K items of information in the first tuple with the second key-value pairs in each second session table to determine a target code value group corresponding to the K items of information in the first tuple; A first hash value corresponding to K items of information in the first tuple is determined based on the target code value group.

3. The method according to claim 2, characterized in that The at least one second session table includes a first session sub-table and a second session sub-table, the key of the second key-value pair of the first session sub-table corresponds to M items of information in the K items of information in the second tuple, the key of each second key-value pair of the second session sub-table corresponds to KM items of information in the K items of information in the second tuple, 1≤M<K; The matching of the K items of information in the first tuple with the second key-value pairs in each second session table to determine a target code value group corresponding to the K items of information in the first tuple includes: Matching the M items of information in the first tuple with the second key-value pair of the first session subtable, and matching the KM items of information in the first tuple with the second key-value pair of the second session subtable; If a match is successful with one of the second key-value pairs in the first conversation sub-table and one of the second key-value pairs in the second conversation sub-table, a first target encoding value and a second target encoding value are obtained, wherein the first target encoding value is an encoding value corresponding to the value of the second key-value pair that successfully matches in the first conversation sub-table, and the second target encoding value is an encoding value corresponding to the value of the second key-value pair that successfully matches in the second conversation sub-table; The first target coded value and the second target coded value are taken as at least part of the target coded value group.

4. The method according to claim 3, characterized in that The method further comprises at least one of the following: If the match with any second key-value pair of the first session sub-table fails, the preset invalid code value is used as the first target code value or the first data packet is sent to the first chip; If the match with any second key-value pair in the second session sub-table fails, the preset invalid code value is used as the second target code value or the first data packet is sent to the first chip.

5. The method according to claim 3, characterized in that: There are at least two first session tables, and the at least two first session tables correspond to at least two hash functions in a one-to-one manner. For each of the at least two first session tables, a second hash value corresponding to a key of a first key-value pair of the first session table is determined based on the hash function corresponding to the first session table. The determining, based on the target code value group, a first hash value corresponding to K items of information in the first tuple includes: Compressing the target code value group based on each hash function of the at least two hash functions to obtain a first hash value corresponding to each hash function; The matching the first hash value and the LK item information in the first tuple with the first key-value pair of the first session table includes: The first hash value corresponding to each hash function and the LK item information of the first tuple information are matched with the first key-value pair of the first session table corresponding to each hash function.

6. The method according to any one of claims 1 to 5, characterized in that: The LK item information in the first session table is determined in the following manner: Acquire multiple forwarded second data packets; For each second data packet, extract a second tuple from a data packet header of the second data packet, the second tuple including a source protocol address, a source port, a protocol, a destination protocol address, and a destination port; Determine, based on the second tuple corresponding to each second data packet, a first maximum number of occurrences of a same source address, a second maximum number of occurrences of a same source port, a third maximum number of occurrences of a same protocol, a fourth maximum number of occurrences of a same destination protocol address, and a fifth maximum number of occurrences of a same destination port in the plurality of second data packets; determining a maximum value among the first maximum number of occurrences, the second maximum number of occurrences, the third maximum number of occurrences, the fourth maximum number of occurrences, and the fifth maximum number of occurrences; An item of information corresponding to the maximum value in the second tuple is determined as the LK item of information in the first session table.

7. The method according to any one of claims 1 to 5, characterized in that: The forwarding information includes first forwarding information and second forwarding information, the first forwarding indication information includes a second encoding value and the second forwarding information, the first session table entry also includes a third session table, the third session table includes at least one third key-value pair, for each third key-value pair, the key of the third key-value pair corresponds to the third encoding value, and the value of the third key-value pair corresponds to the first forwarding information; The determining, based on the first forwarding indication information corresponding to the value of the first key-value pair that successfully matches, the target forwarding information of the first data packet includes: Matching the first code value corresponding to the value of the first key-value pair that matches successfully with the third key-value pair of the third session table; If a match is successful with one of the third key-value pairs, the first forwarding information corresponding to the value of the successfully matched third key-value pair and the second forwarding information corresponding to the value of the successfully matched first key-value pair are determined as at least part of the target forwarding information of the first data packet; If the match with any third key-value pair fails, the first data packet is discarded.

8. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: If the match with any first key-value pair fails, sending the first data packet to the first chip, so that the first chip determines the target forwarding information of the first data packet; Obtaining a target session table entry from a second chip; updating the first session table entry based on the target session table entry, so that when a new data packet to be forwarded is obtained, forwarding information of the new data packet to be forwarded is determined based on the updated first session table entry; The target session table entry includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to a first hash value and LK item information in the first tuple, the first hash value is a hash value corresponding to the K item information of the first tuple, the value of the fourth key-value pair corresponds to second forwarding indication information, the second forwarding indication information is used to determine the target forwarding information corresponding to the first tuple, and the fourth session table is used to update the first session table in the first session table entry.

9. A method for determining forwarding information, characterized in that: include: Acquire a first data packet from a second chip; extracting a first tuple from a data packet header of the first data packet; Searching for a target session table entry corresponding to the first multi-group from a preset second session table entry, the target session table entry includes a fourth session table, the fourth session table includes a fourth key-value pair, the key in the fourth key-value pair corresponds to a first hash value and LK items of information in the first multi-group, the first hash value is a hash value corresponding to K items of information in the first multi-group, the value of the fourth key-value pair corresponds to second forwarding indication information, and the second forwarding indication information is used to determine target forwarding information corresponding to the first multi-group, wherein 1≤K<L, and L represents the total number of information items in the multi-group; If the target session table entry is successfully searched, target forwarding information of the first data packet is determined based on the target session table entry, and the target session table entry is sent to the second chip, so that the second chip updates a preset first session table entry based on the target session table entry, wherein the fourth session table is used to update the first session table in the first session table entry.

10. The method according to claim 9, characterized in that The target session table entry further includes at least one of a fifth session table or a sixth session table, wherein the fifth session table is used to update the second session table in the first session table entry, and the sixth session table is used to update the third session table in the first session table entry; Each fifth session table includes a fifth key-value pair, for a fifth key-value pair of a fifth session table, a key of the fifth key-value pair corresponds to at least part of K items of information in the first tuple, a value of the fifth key-value pair corresponds to a target encoding value, and a set of information of at least one fifth session table includes the K items of information in the first tuple; The target forwarding information includes first target forwarding information and second target forwarding information, the second forwarding indication information includes a fourth encoding value and second target forwarding information, the sixth session table includes a sixth key-value pair, the key of the sixth key-value pair corresponds to the fourth encoding value, and the value of the sixth key-value pair corresponds to the first target forwarding information.

11. The method according to claim 10, characterized in that The fifth session table includes a third session sub-table and a fourth session sub-table, the key in the fifth key-value pair of the third session sub-table corresponds to M items of information in the K items of information in the first tuple, the value in the fifth key-value pair of the third session sub-table corresponds to the first target encoding value, the key in the fifth key-value pair of the fourth session sub-table corresponds to the KM items of information in the first tuple, the value in the fifth key-value pair of the fourth session sub-table corresponds to the second target encoding value, 1≤M<K; The third session sub-table is used to update the first session sub-table in the second session table, and the fourth session sub-table is used to update the second session sub-table in the second session table.

12. The method according to any one of claims 9 to 11, characterized in that: If the query of the target session entry fails, the method further includes: Allocating target code value groups corresponding to K items of information in the first multi-group; Obtaining a hash collision result, wherein the hash collision result represents a candidate code value group corresponding to each of at least two hash functions, wherein, for each hash function, any two candidate code value groups corresponding to the hash function have different hash values ​​determined based on the hash function; If the target code value group is the same as one of the candidate code value groups corresponding to one of the hash functions, assigning target forwarding information of the first data packet, generating the target session table entry based on the target forwarding information, and sending the target session table entry to the second chip; The first hash value corresponding to the key in the fourth key-value pair of the fourth session table is obtained by compressing the target code value group based on a hash function corresponding to a candidate code value group that is the same as the target code value group.

13. The method according to claim 12, characterized in that The hash collision result is obtained in the following way: Obtain multiple candidate encoding value groups; Performing hash conflict resolution processing on the plurality of candidate code value groups by using at least two hash functions until an end condition is satisfied, thereby obtaining the hash conflict result; The hash conflict resolution process includes: Compressing each of the plurality of candidate code value groups by using one of the hash functions to obtain a hash value corresponding to each candidate code value group; If the hash value corresponding to one of the candidate code value groups is different from the hash value corresponding to any other candidate code value group among the multiple candidate code value groups, then the one of the candidate code value groups is used as the candidate code value group corresponding to the one of the hash functions, and the other candidate code groups are candidate code value groups other than the one of the candidate code value groups; If the hash values ​​corresponding to at least two of the candidate code value groups are the same, compressing the at least two candidate code value groups with the same hash value by another hash function; The termination condition includes at least one of the following: One hash function among the at least two hash functions corresponding to each candidate code group in the plurality of candidate code value groups; A hash collision resolution process has been performed by any one of the at least two hash functions.

14. A device for determining forwarding information, characterized in that: include: A first acquisition module, used to acquire a first data packet to be forwarded; A first extraction module, configured to extract a first tuple from a data packet header of the first data packet; a second acquisition module, configured to acquire a preset first session table entry, and determine a first hash value corresponding to K items of information in the first tuple, where 1≤K<L, and L represents the total number of information items in the tuple, the first session table entry includes a first session table, the first session table includes at least one first key-value pair, for each first key-value pair, a key of the first key-value pair corresponds to a second hash value and LK items of information in a second tuple of a forwarded second data packet, the second hash value is a hash value corresponding to the K items of information in the second tuple, the value of the first key-value pair corresponds to first forwarding indication information, and the first forwarding indication information is used to determine forwarding information corresponding to the second tuple; A first determining module, configured to match the first hash value and the LK item information in the first tuple with a first key-value pair of the first session table; The first determination module is further configured to determine target forwarding information of the first data packet based on first forwarding indication information corresponding to the value of the first key-value pair that successfully matches, if the first key-value pair is successfully matched.

15. A device for determining forwarding information, characterized in that: include: A third acquisition module, used to acquire a first data packet from a second chip; A second extraction module, configured to extract a first tuple from a data packet header of the first data packet; a search module, configured to search a target session table entry corresponding to the first multi-group from a preset second session table entry, the target session table entry including a fourth session table, the fourth session table including a fourth key-value pair, the key in the fourth key-value pair corresponding to a first hash value and LK items of information in the first multi-group, the first hash value being a hash value corresponding to K items of information in the first multi-group, the value of the fourth key-value pair corresponding to second forwarding indication information, the second forwarding indication information being used to determine target forwarding information corresponding to the first multi-group, wherein 1≤K<L, and L represents the total number of information items in the multi-group; a second determination module, configured to determine target forwarding information of the first data packet based on the target session table entry if the target session table entry is successfully searched, and to send the target session table entry to the second chip, so that the second chip updates a preset first session table entry based on the target session table entry, wherein the fourth session table is used to update the first session table in the first session table entry.

16. A gateway comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 8, or implements the method according to any one of claims 9 to 13.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 8, or implements the method described in any one of claims 9 to 13.

Images